---
title: "@octokit/request security advisories"
description: "1 known security advisory for @octokit/request, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/@octokit/request/security
lang: en
---

[Packages](https://inlinr.com/packages)

# @octokit/request

10.0.16 · 30 Aug 2026 MIT 52M / week [Repository](https://github.com/octokit/request.js) [Homepage](https://github.com/octokit/request.js#readme) [npm](https://www.npmjs.com/package/@octokit/request) [Atom feed](https://inlinr.com/packages/feed/@octokit/request)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest  | Where it stands                                                               |
| ---- | ------- | ----------------------------------------------------------------------------- |
|      | 10.0.16 | No known advisory                                                             |
|      | 9.2.4   | 7 open advisories, worst moderate  · last release Jun 2025, no longer updated |

- Moderate  
[@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking](https://inlinr.com/advisories/GHSA-rmvr-2pp2-xj38)GHSA-rmvr-2pp2-xj38 · 14 Feb 2025  
fixed in 9.2.1, 8.4.1

### Quality and security signals

What [npm](https://www.npmjs.com/package/@octokit/request) and [deps.dev](https://deps.dev/npm/%40octokit%2Frequest) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 5 Nov 2026\. Releases and advisories last read 5 Nov 2026.